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Abstract 

We construct a total Boolean function / satisfying R{f) — refuting the long-standing 

conjecture that R{f) = 0{Q{f)^) for all total Boolean functions. Assuming a conjecture of Aaronson and 
Ambainis about optimal quantum speedups for partial functions, we improve this to R{f) = 

Our construction is motivated by the G66s-Pitassi-Watson function but does not use it. 


1 Introduction 

The deterministic query complexity of a function / : {0, l}'^ —>■ {0,1} is the minimum, over all deterministic 
algorithms, of the worst-case number of queries to the bits of an input x G {0,1}'^ the algorithm requires 
to determine f{x). This value is denoted by D(f). The randomized query complexity, denoted by R{f), 
is defined similarly, except the algorithm is allowed to use randomness and is only required to correctly 
determine /(x) with probability at least 2/3 for all x. The quantum query complexity Q{f) is analogous to 
i?(/), except the algorithm is allowed quantum queries. 

It is clear that Q{f) < R{f ) < D[f). Beals, Buhrman, Cleve, Mosca, and de Wolf [5] showed that for all 
total functions /, D{f) = 0{Q{f)^). In particular, this implies that R{f) = 0{Q{f)^). For a summary of 
query complexity relations, see [4]. 

Until recently the only known gap between D{f) and Q{f) was quadratic. It was conjectured that this is 
tight. In a recent breakthrough, Ambainis, Balodis, Belovs, Lee, Santha, and Smotrovs [2] provided a total 
function exhibiting a degree 4 separation between D{f) and Q(/), refuting this conjecture. This function was 
a variant of the G66s-Pitassi-Watson (GPW) function, introduced in However, this function had only 
a quadratic gap between R{f) and Q{f), as its quantum speedup was based only on Grover search, which 
fundamentally provide at most a quadratic speedup. This has led to the suggestion that the R{f) = 0{Q{f)'^) 
conjecture might still hold for total Boolean functions. 

In this work, we provide a total function exhibiting super-Grover (degree 2.5) quantum speedup over 
randomized algorithms. By assuming a conjecture of Aaronson and Ambainis [T], we improve this separation 
to degree 3. Our construction is not directly based on the GPW function, and is substantially different from 
those the GPW variants in [2]. However, it is similar to GPW in several ways, including the use of pointers 
and depth-2 and-or trees. 


2 Preliminaries 

The following two functions will be used in our construction. 

Forrelation: The Forrelation function was introduced by Aaronson and Ambainis [1]. It provides 
the largest known gap between randomized and quantum query complexities in the promise setting, with 
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Qif) = 0(1) and R{f) = (where m is the size of the input). A variant of Forrelation is 

conjectured to satisfy Q{f) = 0{\ogm) and R{f) = 

Or-And: This function is an Or on m bits composed with m copies of And on m bits. In other words, 
its input is an m-by-m matrix, and the value of the function is 1 if and only if there is an all-1 column in 
the matrix. The randomized query complexity of Or-And is 0(m^), and the quantum query complexity is 
0(m). In addition, note that an Or-And instance always has a certificate of size m: either an all-1 column, 
or else a 0 in each column. The final property we will use is that if a quantum algorithm is given pointers 
to the m bits in a certificate for Or-And, it can verify the certificate using queries. 


3 Constructing the Function 

3.1 Sketch of Construction 

The idea of the construction is as follows. The Forrelation function provides a large quantum speedup in 
the promise setting, requiring randomized queries but only 0(1) quantum queries. We wish to turn 

it into a total function. To do this, we compose Forrelation with Or-And; that is, we replace each bit of 
the Forrelation function with an m by m copy of Or-And. This slows down both the randomized and 
quantum algorithms. Any randomized algorithm now uses fl(m^/^) queries, while a quantum algorithm can 
use 0(m). For lack of a better name, we will refer to this composed function as Forandlation. 

We then use the solution of the Forandlation instance to find a “cheat sheet” that links to the 
certificates of all the Or-And instances; using this cheat sheet, a quantum algorithm can verify that the 
input satisfied the Forrelation promise without solving the Or-And instances. In fact, it can do the 
verification using 0{m) queries. We can then make the value of the function equal to 0 if the verification 
fails, which turns the function total. 

How do we use the Forandlation instance to find such a cheat sheet, while ensuring that a randomized 
algorithm cannot find it? We do this by assuming that the input contains not just the Forandlation in¬ 
stance, but also an array of size (say) full of candidate sheets. In addition, instead of one Forandlation 
instance we will need lOlogm Forandlation instances. We will use the answers of these Forandlation 
instances as the index of a sheet in the array, and assert that this is the cheat sheet. A randomized algorithm 
cannot find this cheat sheet, but a quantum algorithm can. 

Once again, if anything goes wrong - if the cheat sheet does not link to proper certificates, or if the 
certified Or-And answers don’t make up instances in the promise of Forrelation - we set the value of 
the function to 0. In all other cases, the value of the function will be a special bit on the cheat sheet. 

3.2 Formal Construction 

Let X be the input. We define the value of our function g on x as follows. 

Let m be (say) the 20-th root of the input size. We will interpret the first lOm^ logm bits of x as 10 logm 
instances of Forandlation (each containing bits). The next 0{m}^ log^ m) bits of x will be interpreted 
as an array of size whose entries have 0{m? log^ m) bits each. The rest of the input will be ignored. 

If the Forandlation instances don’t all satisfy their promise, we set g{x) := 0. Otherwise, the solution 
to the Forandlation instances will be used as an index of the array. The entry of the array corresponding 
to that index will be called the cheat sheet. 

The first lOm logm bits of the cheat sheet will be interpreted as the solutions to all the Or-And instances 
inside the 10 logm Forandlations, in order. If these bits are not equal to the Or-And values, we set 
g{x) := 0. 

The next O(m^log^m) bits of the cheat sheet will be interpreted as lOm^logm pointers to bits in the 
Forandlation part of the input. These pointers should correspond to certificates for each of the lOmlogm 
Or-And instances (all the certificates have size m). If they do not, we set g{x) := 0. 

Finally, if the value of x has not yet been set to 0, we set it to the bit of the cheat sheet which immediately 
follows the aforementioned pointers. 
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4 Quantum Upper Bound 

We provide an algorithm for evaluating g using 0{m) queries. For simplicity, we will ignore log factors in 
our analysis, which allows us to ignore amplification concerns. 

First, note that Forandlation can be solved by a quantum algorithm using 0{m) queries. This is 
because Forandlation is a composition of Forrelation, which requires 0(1) queries, and Or-And, 
which requires 0(m) queries. 

Our quantum algorithm will begin by evaluating the 10 log m Forandlation instances in the input, 
using 0{m) queries. It will then go to the designated entry of the array, and read the hrst 10m log to bits 
(the ones representing the answers to the Or-And instances). This takes an additional 0 (to) queries. The 
algorithm will then verify that the 10m log to bits it read satisfy the promises of 10 log to Forrelation 
instances. If a promise isn’t satisfied, the algorithm will return 0. 

Next, the quantum algorithm will use the lOm^ logm pointers to Grover-search for an invalid certificate. 
There are 10m log to certihcates to check, and each one takes 0 (i/to) quantum queries to verify, so this 
Grover search takes 0{m) queries. If a bad certificate is found, the algorithm returns 0. 

Finally, the algorithm will query the remaining bit of the array entry and return its value. 

This algorithm uses a total of 0{m) queries. Its correctness is easy to see: the algorithm only returns 1 
if all the Forandlation promises hold and the cheat sheet successfully certifies this fact. 

5 Randomized Lower Bound 

5.1 Forandlation Lower Bonnd 

We show that a randomized algorithm will take at least fi(m®/^) queries to solve a Forandlation instance 
consisting of to^ bits. 

Let A be any randomized algorithm for this problem. We turn A into an algorithm B for solving 
Forrelation on to bits. Gonsider any input x for Forrelation on to bits. Ghoose m random m-hy-m 
matrices with the property that each column of the matrix has exactly one 0. Then, for z = 1,2,..., m, pick 
a random 0 in the z-th matrix and replace it with Xi. This construction turns the input x for Forrelation 
into an input x' for Forandlation which has the same value. 

Now, we get the algorithm B to simulate A on x'. Whenever A queries a bit of x, B queries the 
corresponding input of x and gives A the answer Once A terminates, B returns the answer it gives. 

We’ll show that a randomized algorithm must use Q,{rn?) queries to hnd the special Xi bit in a matrix. 
This will imply that if A succeeds with probability at least 2/3 after at most k queries, then B succeeds 
after (^{klrn^) queries to x. Since Forrelation requires queries, it follows that A requires 0(to®/^) 

queries. If Forrelation were replaced by a function with randomized query complexity at least 0(to.), this 
would become instead. 

It remains to show that a randomized algorithm must use Vlirn?') queries to find Xi. We can think of 
Xi as a random marked zero in a matrix that has exactly one zero randomly placed in each column (the 
rest of the matrix is filled with ones). To find the marked zero with probability at least 1/2, a randomized 
algorithm must find at least half the zeros. Now, if a randomized algorithm made only Oirrij logm) queries 
in a given column, then its chance of finding a zero in that column is at most 0(1 /to). By the union bound, 
the randomized algorithm will only discover a zero in columns in which it queried at least ^(to,/ logm) bits. 
Since we require the randomized algorithm to find to/ 2 zeros, the total number of queries it must make is 
at least This completes the argument. 

5.2 Lower Bound for g 

We now show a lower bound for the randomized query complexity of our function g. Let A be a randomized 
algorithm for g that uses at most k queries. Gonsider giving A an input which satisfies the promises of all 
the Forandlation instances, but which has an empty array (that is, the array contains only zeros). Then 
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the value of g on this instance is 0, so ^ outputs 0 after k queries with probability at least 2/3. We can 
amplify this to 99/100 and increase k by only a constant factor. 

Now, if we instead give A an instance which is identical except that the appropriate cell of the array 
contains a valid cheat sheet, then A must output 1 with probability at least 99/100. This means a bit of the 
appropriate cell was queried with high probability. 

In other words, when we run A with an empty array, we get a list of at most k spots in the array where 
the cheat sheet should be (this list is simply the cells of the array that are queried by this randomized 
algorithm). This list contains the correct location for the cheat sheet with high probability. 

We can think about the indices of the array as binary strings. The algorithm A gives us a set S of at 
most k binary strings such that the string of answers to the Forandlation instances is in S (with high 
probability). 

Let be a hard distribution over the inputs of Forandlation, so that any randomized algorithm must 
make 0(m®/^) queries to evaluate Forandlation on a random input sampled from V. We can split V into a 
distribution over 0-inputs to Forandlation and a distribution over 1-inputs such that distinguishing 
between these distributions takes (/(m®/^) queries for a randomized algorithm. 

Now, consider giving A 10 logm inputs to Forandlation that are each sampled from The algorithm 
A produces a set S of binary strings, and with high probability, the all-0 string is in S. 

Assuming k < m^, there is some binary string of length 10 log to whose probability of being in S is less 
than XjrvA. Let t be such a string. Consider a sequence of strings starting with the all-0 string and ending 
with t, such that any two consecutive strings x and y in the sequence differ in exactly one bit, with y having 
one more 1 than x. This sequence will have length O(logTO). 

For each string x in the sequence, we form an input to A by concatenating samples from for i = 
1,2,..., 10logTO, and adding a blank array. This gives us 0{logm) distributions over inputs to A. By 
construction, A distinguishes the first distribution (based on the all-zero string) from the last distribution 
(based on t), since the former will have very small probability of including t in S' while the latter will have 
high probability. 

From this it follows that there is some consecutive pair of strings in this sequence that A distinguishes with 
probability at least 0(1/logm). However, distinguishing a consecutive pair can be used to distinguish 
and 22^, which is as hard as Forandlation. It follows that A uses at least 0(to®/^) queries, as desired. The 
same proof shows a lower bound of O(to^) if there is a function / with Q{f) = 0{logm) and R{f) = 

6 Final Remarks 

In this proof, we used several specific properties of the Or- And function, but no properties of Forrelation 
other than its randomized and quantum query complexities. This means the same proof technique will 
extend to functions other than Forrelation, and may be used to provide separations between other query 
complexity measures. It might also be interesting to try to combine this technique with the G66s-Pitassi- 
Watson variants of [5]. 
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